Dependency Firewall early access: 50% off the base fee. See pricing

Run image pulls through the same rules

A container image is a dependency too. A base image brings an operating system and several hundred OS packages into a build, and each of them can carry vulnerabilities. Image pulls and pushes pass the same rules as packages.

Start 14-day free trialBook a demo

How container firewalling works

  1. 1Change the registry host

    Log in with docker, crane or oras. Dockerfiles and manifests keep their image names, and only the host changes.

  2. 2Choose what stops a pull

    Vulnerable OS packages, malware, leaked secrets or an image that is too new. A rule runs each time an image is pulled.

  3. 3A blocked pull comes with a reason

    The client gets a missing-image error with a request ID. The log entry for that ID names the rule that stopped it.

What the rules catch in an image

Vulnerable OS packages
An image is stopped when an OS package in it is above your threshold. The firewall reads the apk, dpkg and rpm databases in the layers and matches them against each distribution's own advisories.
Secrets and malware in any layer
A credential in an early layer is found even when a later build step deletes the file. Every layer is scanned.
No way around a block by tag
An image is checked under every tag it carries. When latest points at a blocked 3.18, a pull of latest is blocked too.
New advisories apply on the next pull
The firewall keeps no verdicts. Each pull is matched against the advisory data of that moment, so an image that passed yesterday is blocked when it is requested again after a new advisory. Copies already pulled are not touched.
Vulnerability rule on image pulls
{  "id": "block-vulnerable-images",  "executionPhase": "download",  "selector": {    "function": {      "name": "vulnerabilities",      "options": {        "maxCvssScore": 9.0,        "maxEpssScore": 0.5      }    }  },  "ruleEffect": { "block": true, "log": true }}

Questions

Are application dependencies inside the image checked?

No. The vulnerability rule checks the OS packages installed in the image. Route npm, Maven or PyPI installs through their own firewall when the image is built.

What about scratch and distroless images?

An image without a package database has no OS packages to match, so it passes a vulnerability rule. Malware and secrets rules still scan its layers.

Can new image tags be held back?

Yes. A delay rule measures the age of an image from the created date in its configuration. The build writes that date, so an image built with a backdated date looks older than it is.

More features

Also in the Bytesafe platform

Try it on one registry

Point one package manager at Dependency Firewall and check the log after the next install. The trial runs 14 days.

Start free trialBook a demo